On this page
Key facts (as of 29 October 2026)
- Global standard: the FATF Recommendations. Recommendation 15 and its Interpretive Note, updated in 2019, apply AML/CFT measures to virtual assets and VASPs.
- Proportionality: in February 2025 FATF amended Recommendation 1 and related standards to stress proportionate, risk-based measures and simplified measures for lower risks, partly to counter over-compliance that excludes legitimate customers.
- Implementation gap: FATF's July 2026 targeted update said many jurisdictions have yet to turn VASP laws into effective supervision, and that most identified on-chain illicit activity now involves stablecoins.
- US issuers: under the GENIUS Act, payment stablecoin issuers fall under the Bank Secrecy Act. The BSA/AML and OFAC rules for issuers are a separate Treasury-led rulemaking.
- Scale of the problem: one industry estimate cited by FATF in 2025 put illicit on-chain activity linked to fraud and scams at about US$51bn in 2024.
The building blocks
| Control | What it involves |
|---|---|
| Risk-based approach | Assess customer, product, channel and geographic risk, and scale controls to it |
| Customer due diligence (CDD/KYC) | Identify and verify customers and beneficial owners, and understand the nature and purpose of the relationship |
| Enhanced due diligence | Extra checks for higher-risk customers, PEPs and high-risk jurisdictions |
| Source of funds and wealth | Evidence of where the money in a transaction, and the customer's overall wealth, came from |
| Ongoing monitoring | Transaction monitoring, periodic review and screening |
| Reporting | Suspicious activity or transaction reports to the national FIU |
| Record-keeping | Retain identity and transaction records for the legal period |
Onboarding a high-risk merchant
flowchart TD
A[Application] --> B[Identify entity, directors and beneficial owners]
B --> C[Sanctions, PEP and adverse media screening]
C --> D{Licence required for the activity?}
D -- Yes --> E[Verify licence on regulator register]
D -- No --> F[Document why not]
E --> G[Assess risk: product, geography, channel]
F --> G
G --> H{High risk?}
H -- Yes --> I[Enhanced due diligence: source of funds, site review, wallet history]
H -- No --> J[Standard due diligence]
I --> K[Approve with monitoring rules, or decline]
J --> KSource of funds for stablecoin proceeds
Banks want the on-chain history and the paperwork to tell the same story. For crypto-origin funds, private.law lists:
- wallet addresses and transaction hashes
- exchange statements, going back years where relevant
- contracts for the original purchases
- tax returns where the income was declared
- a blockchain-forensics report on the addresses
private.law warns that gaps in the chain have to be explained with documents. The longer assets sat in self-custody, the harder the file is to build.
How the stablecoin leg changes compliance
| Bank transfer | Stablecoin transfer |
|---|---|
| Identity attached by the bank | Address is pseudonymous; identity comes from VASP records and the Travel Rule |
| Reversible in some cases | Final once confirmed; screening must come first |
| Correspondent banks screen in transit | Issuer and VASP screening; blockchain analytics traces exposure |
| Payment reference describes purpose | Purpose must be documented off-chain |
WarningStablecoins are not a way around AML. FATF has reported that most on-chain illicit activity now involves stablecoins, so supervisors and banks look harder at stablecoin flows, not less.
NoteFor high-risk merchants, a strong KYC file is also commercial protection. It is what keeps banking and settlement relationships open, and it reduces the chance of de-risking.
Jurisdiction breakdown
| Jurisdiction | Main framework | Crypto angle |
|---|---|---|
| Global | FATF Recommendations | R.15 for VASPs; R.16 Travel Rule |
| European Union | AML directives; AML Regulation (EU) 2024/1624 applies from 10 July 2027; AMLA as new EU authority | CASPs are obliged entities; Travel Rule via Regulation 2023/1113 |
| United Kingdom | Money Laundering Regulations 2017 | Cryptoasset firms registered with the FCA; new cryptoasset regime from 2027 |
| United States | Bank Secrecy Act, FinCEN | Money transmitters dealing in convertible virtual currency are MSBs; GENIUS Act brings issuers under the BSA |
Sector specifics
| Sector | Key checks |
|---|---|
| Gambling | Player KYC, age verification and affordability checks. In the UK, financial vulnerability checks from £150 net deposits in 30 days |
| Crypto and OTC | VASP licensing, Travel Rule, wallet screening |
| Remittance | Licensing in send and receive markets, and agent oversight |
| Forex and CFD | Appropriateness tests; client money rules; screening of funding sources |
See Descriptors and transaction laundering for a payments-specific AML risk.
Illustrative example: a source-of-funds file
Illustrative example. The business and figures are invented.
An iGaming affiliate asks a bank to accept US$2m of USDC proceeds converted through an exchange. The bank asks for the exchange statements, the affiliate contracts that generated the income, invoices to the operator, the wallet addresses, and an analytics report. The report shows one inbound transfer of US$40,000 from a high-risk exchange. The affiliate explains it with an invoice and the operator's own payout record. The bank accepts the file with a note on that transfer.
Timeline
| Date | Event |
|---|---|
| June 2019 | FATF applies standards to virtual assets and VASPs |
| 30 Dec 2024 | EU Travel Rule for crypto-asset transfers applies |
| Feb 2025 | FATF amends R.1 on proportionality and simplified measures |
| 18 Jul 2025 | GENIUS Act signed; issuers to fall under BSA |
| 16 Jul 2026 | FATF seventh targeted update |
| 18 Jan 2027 | GENIUS Act and OCC rule effective |
| 10 Jul 2027 | EU AML Regulation applies |
Q/A
Who is responsible for AML in a stablecoin payment?
Every regulated party in the chain: the business itself if it is an obliged entity, its PSP, the VASPs on each side and the issuer.
Is wallet screening enough for KYC?
No. Screening shows a wallet's exposure. KYC identifies who controls it and why they are transacting.
Does FATF's proportionality change mean lighter checks for high-risk sectors?
No. It means checks should match risk. High-risk sectors still face enhanced due diligence; lower-risk customers should not be excluded by blanket policies.
How long must records be kept?
It depends on the regime. Five years is common under FATF-aligned laws. Check local rules.
Can a merchant rely on its PSP's KYC?
For its own obligations, only where the law allows reliance and the merchant has assessed it. The PSP still does its own checks on the merchant.
What is a red flag specific to stablecoins?
Funds arriving via mixers, sanctioned addresses, or high-risk exchanges; rapid chain-hopping; and structuring into small transfers.
Sources
- FATF, seventh targeted update on virtual assets and VASPs (16 July 2026): https://www.fatf-gafi.org/en/news/targeted-updated-va-vasps-2026.html
- FATF, targeted update on virtual assets and VASPs (26 June 2025): https://www.fatf-gafi.org/en/publications/Fatfrecommendations/targeted-update-virtual-assets-vasps-2025.html
- FATF, amendments on proportionality (February 2025): https://www.fatf-gafi.org/en/publications/Fatfrecommendations/update-standards-promote-financial-conclusion-feb-2025.html
- private.law, Crypto private wealth: https://wiki.private.law/en/crypto-private-wealth
- OCC Bulletin 2026-50: https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-50.html
- Regulation (EU) 2024/1624 (AMLR): https://eur-lex.europa.eu/eli/reg/2024/1624/oj
- Finzil (18 October 2026): https://finzil.com/blog/igaming-payment-challenges
FiatDesk Wiki is educational. Not financial or legal advice.